test: pin local tsx runner

[appergb]

User description

Summary

• pin tsx 4.23.1 as a direct exact devDependency
• execute the side-modifier test through npm local node_modules/.bin
• keep the package lock authoritative for clean and offline runs

TDD evidence

RED on current Beta after clean npm ci: there was no local node_modules/.bin/tsx; with a new empty npm cache and offline mode, npm run check:hotkey-side-modifiers failed with ENOTCACHED because npx attempted to resolve the registry package.

GREEN after this change: a fresh npm ci installed the locked binary and the same command passed with an empty cache, npm_config_offline=true, and an unreachable registry URL.

Verification

• clean npm ci: 0 vulnerabilities
• offline npm run check:hotkey-side-modifiers: passed
• npm run build: passed, including the Android IPC prebuild boundary
• npm audit --audit-level=high: 0 vulnerabilities
• git diff --check: passed

No product or UI behavior change.

Closes #805

---

PR Type

Bug fix, Tests

---

Description

• Pin tsx as exact devDependency (4.23.1)

• Update test script to use local binary instead of npx

---

Diagram Walkthrough

flowchart LR
  A["package.json"] --> B["Add tsx@4.23.1 as devDependency"]
  A --> C["Change script: npx tsx -> tsx"]

Loading

File Walkthrough

	Relevant files
Bug fix	package.json Pin tsx and update test script                                                      openless-all/app/package.json Added tsx as a pinned devDependency (exact version 4.23.1) Updated check:hotkey-side-modifiers script to invoke tsx directly instead of via npx +2/-1

---

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 208a7ba)

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 805 - Partially compliant Compliant requirements: Add tsx as a pinned/locked devDependency and invoke the local npm-script binary. The check works after a clean npm ci with network disabled for the test command. Existing frontend tests/build pass. No product/UI behavior change. Non-compliant requirements: (empty) Requires further human verification: (empty)

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

[appergb]

Independent review — exact head 208a7ba

Strengths

• package.json:22,56 replaces npx tsx with the npm-script local binary and pins tsx as a direct exact devDependency at 4.23.1. The root package-lock entry matches exactly.
• package-lock.json:6214-6231 records the exact tarball, integrity, CLI bin, Node engine and dependency edge. The nested esbuild lock graph contains all 26 declared platform packages with no missing or mismatched versions, including macOS, Windows, Linux and Android architectures.
• Strict RED was independently reproduced on base d6ca07a: after clean npm ci, no local .bin/tsx existed; a new empty cache with offline mode and registry 127.0.0.1:9 made the old npx script attempt /tsx and fail with ENOTCACHED.
• Strict GREEN was independently reproduced on this exact head: clean npm ci using an isolated install cache created node_modules/.bin/tsx -> ../tsx/dist/cli.mjs; then a separate new empty runtime cache with offline mode and the same unreachable registry passed hotkeySideModifiers.test.ts. This proves the script resolves the locked local binary without registry fallback.
• Fresh npm registry metadata reports 4.23.1 as the current latest release with Node >=18.0.0; the installed CLI and test both ran successfully under Node 22.17.1.
• npm run prebuild, npm run build and npm audit --audit-level=high passed with zero vulnerabilities. The complete base and head dist trees were byte-identical, confirming no UI or runtime bundle change.
• All five exact-head checks are completed and successful: Windows, macOS, Linux, Android cargo check and PR-Agent.

Critical

None.

Important

None.

Minor

• package-lock.json:6675 necessarily nests esbuild 0.28.1 for current tsx beside Vite esbuild 0.25.12, because the dependency ranges do not overlap. This adds one dev-only compiler copy and the corresponding cross-platform lock entries, but clean install added only three packages on this host, audit is clean, and production output is identical. Informational only; no change requested.

Ready-to-merge verdict

COMMENTED — logical APPROVE. No blocking finding at the reviewed exact head. The change satisfies issue #805, makes the check reproducible after a clean install without runtime registry access, has a complete cross-platform lock graph, and does not alter product behavior. It is ready from a code-review perspective once normal Draft and repository review policy are satisfied.

[github-actions]

Persistent review updated to latest commit 208a7ba